Revive Adserver: Reflected cross-site scripting in popup invocation options
Summary
Revive Adserver 6.0.8 and earlier contains a reflected cross-site scripting (XSS) flaw in the popup invocation options. The top, left, timeout and delay request parameters are placed into HTML attributes without encoding. An attacker can make a logged-in user execute JavaScript in their browser by tricking them into opening a crafted URL, which requires an existing popup zone that the normal zone-creation interface does not offer.
Affected
- Revive Adserver 6.0.8 and earlier (per CNA record; older versions covered by the range 0 to <= 6.0.8)
Fixed in
- Revive Adserver 6.0.9 (HTML-encodes the affected popup option values)
- Vendor advisory not confirmed at time of writing; check revive-adserver.com/security/ and the 6.0.9 release notes
Workaround
- No vendor-published workaround found. Upgrading to 6.0.9 is the fix.
- Limit access to the admin interface to trusted networks or VPN.
- Ask administrators not to open untrusted links while logged in to the admin interface.
- Review popup-type zones for entries that nobody on your team created.
Exploitation
- Known exploitation: none found (OffSeq: not known to be exploited).
- Public proof-of-concept: none found in checked indexes; absence is not proof.
- VulDB tags the entry as 0-Day and rates exploitation as easy; this is VulDB's assessment and is not confirmed by exploit evidence.
Our recommendation
- Medium priority. Upgrade to Revive Adserver 6.0.9 in the normal patch cycle; prioritise if the admin interface is internet-facing, if administrators browse the web in the same session, or if popup zones are in use.
- Check whether popup zones exist that nobody on your team created.
- The 6.0.9 upgrade also covers the related 2026 issues CVE-2026-108558, -108559, -108560, -108562, -108563 and -108564.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- HackerOne report hackerone.com
- VulDB entry vuldb.com
- Strix AI CVE page www.strix.ai
- OffSeq Radar threat entry radar.offseq.com
- ThreatInt CVE record cve.threatint.com
- HackerOne report 3473696 (Revive security advisory reference) hackerone.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 20:12.
Original description (NVD)
A reflected cross-site scripting vulnerability in the popup invocation options of Revive Adserver 6.0.8 and earlier allows an unauthenticated attacker to execute JavaScript in an authenticated user's browser by persuading them to visit a crafted URL. The top, left, timeout and delay request parameters are included in HTML attributes without appropriate encoding. Exploitation requires an existing popup zone, which can be created through the administrator API but is not offered by the normal zone-creation interface. The issue is fixed in Revive Adserver 6.0.9 by HTML-encoding the affected popup option values.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.